As is known, quantum key distribution (QKD) is a technique based on the principles of quantum mechanics, which allows two communications devices linked by a quantum channel to generate a random cryptographic key, called a quantum key, which can be used by the communications devices, or by the users of the communications devices, to communicate with each other in a secure manner over a public channel, i.e. an eavesdroppable channel, such as an Internet connection for example.
As is known, the traditional cryptographic key distribution protocols do not allow detecting whether the distributed cryptographic keys have been eavesdropped. In particular, traditional cryptographic key distribution protocols do not allow discovering whether a cryptographic key distributed before starting an encrypted communication based on this cryptographic key has been eavesdropped, for example, through a man-in-the-middle attack.
Instead, QKD allows detecting whether somebody has attempted to abusively eavesdrop the quantum key. In particular, QKD not only enables detecting whether or not somebody has abusively eavesdropped some information exchanged and/or some photons transmitted over the quantum channel during the generation of the quantum key, but also prevents eavesdropped information from being used to trace to the quantum key.
More specifically, for example, the so-called BB84 protocol, described for the first time by C. H. Bennett and G. Brassard in “Quantum cryptography: Public key distribution and coin tossing”, Proc. of the IEEE Int. Conf. on Computers, Systems & Signal Processing, Bangalore, India, Dec. 10-12, 1984, pp. 175-179, is known.
As shown in FIG. 1, where two communications devices are referred to respectively as the first and second communications devices A and B, an implementation of the BB84 protocol envisages the presence of a source S in addition to the first and second communications devices A and B. The source S is connected to the first and second communications devices A and B by a first and a second quantum link QL_1 and QL_2, respectively, each of which is formed, for example, by a span of optical fibre or free space. In practice, the first and second quantum links QL_1 and QL_2 form a quantum channel, interposed between the first and second communications devices A and B; the source S, in turn, is connected to the quantum channel. The first and second communications devices A and B are also connected to each other by a conventional link (i.e., non-quantum) CL, such as a link via the Internet for example.
In operation, the source S transmits, in use, entangled pairs of photons. More specifically, the source S emits one of the so-called Bell states, such as, for example, a singlet state in polarization.
Given an entangled pair of photons emitted from the source S, one of them propagates along the first quantum link QL_1 and can therefore be received by the first communications device A, while the other propagates along the second quantum link QL_2 and can therefore be received by the second communications device B. For example, the photon that propagates along the first quantum link QL_1 and the photon that propagates along the second quantum link QL_2 can be referred to as photon FA and photon FB, respectively.
In principle, each of the first and second communications devices A and B performs, for each photon received, the following operations:                randomly selects a basis, chosen from a set of two polarization bases;        measures the polarization of the received photon, using the selected basis;        determines a corresponding bit, one-to-one associated with the measured polarization; and        stores the determined bit, the selected basis and the time when the photon was received.        
As described in greater detail hereinafter, each of the first and second communications devices A and B has a respective polarizing beam splitter (PBS), the input of which is connected to the corresponding quantum link. Furthermore, each basis of the set of two possible polarization bases is associated with a corresponding rotation angle; therefore, the set of two polarization bases corresponds to a set of two rotation angles, typically equal to 0° and 45°.
In practice, at the level of principle, each of the first and second communications devices A and B rotates its polarizing beam splitter by an angle of alternatively 0° or 45°, with respect to a predetermined position.
If the source S emits, for example, a singlet state, and assuming that photon FA and photon FB are received by the first and the second communications devices A and B with a same basis, it is found that (ideally) a perfect anticorrelation is present between the polarization of the photon FA and the polarization of the photon FB, as measured precisely by the first and the second communications device A and B. Instead, in the case where the first and the second communications device A and B respectively receive photon FA and photon FB with different bases, a loss of anticorrelation between the corresponding polarization measurements occurs.
In greater detail, it is found that when the first and second photons FA and FB are received with the same bases by the first and the second communications device A and B, one of the latter will measure polarization along a direction H, while the other will measure polarization along a direction V, orthogonal to direction H. From a more quantitative standpoint, it is found that the measurement of the polarization of photon FA, by the first communications device A, causes projection of photon FB in the orthogonal state, which is subsequently analysed by the second communications device B, and vice versa. This is due to the fact that the singlet state is invariant with respect to equal rotations.
Having said that, following the generation of a certain number of entangled pairs of photons, the first and second communications devices A and B reciprocally communicate, over the conventional link CL, the bases used to measure the polarizations of the received photons. Furthermore, the first and second communications devices A and B discard, from the bits that they have determined, the bits that correspond to polarization measurements taken with different bases. Given a set of bits determined by one of the first and second communications devices A and B, the set of bits that are not discarded define a corresponding raw key.
In the example considered, the raw keys generated by the first and the second communications device A and B should each be the negation of the other, and should therefore be equal, but for a logical negation process. In the jargon, since this logical negation process is considered implicit, it is thus said that, ideally, the raw keys generated by the first and the second communications device A and B should coincide. In addition, further QKD schemes are known in which the state generated by the source S is such that, when the bases of the first and the second communications device A and B are the same, the latter measure equal polarizations and therefore no logical negation is required.
In reality, the two raw keys do not coincide, due to possible eavesdropping perpetrated by an unauthorized third party and due to the non-ideality of the quantum channel, formed by the first and the second quantum link QL_1 and QL_2, and of the communications devices involved in QKD. Therefore, after having generated the raw keys, the first and second communications devices A and B perform two further steps, which result in the generation of a single cryptographic key. These further steps of the BB84 protocol are known respectively as key reconciliation and privacy amplification and were described for the first time by C. H. Bennett, F. Bessette, G. Brassard, L. Salvail and J. Smolin in “Experimental Quantum Cryptography”, Journal of Cryptology, vol. 5, No. 1, 1992, pp. 3-28.
In particular, in the key reconciliation step, the first and second communications devices A and B correct the errors present in the two raw keys, so as to generate a reconciled key, identical for both of them.
In detail, in the key reconciliation step, the first and second communications devices A and B exchange useful information, over the conventional link CL, for correcting the errors present in the raw keys, minimizing the information transmitted regarding each raw key.
At the end of the information reconciliation step, the first and second communications devices A and B have a same reconciled key.
Then, in the privacy amplification step, the first and second communications devices A and B generate, on the basis of the reconciled key and by means of a reciprocal authentication mechanism, a same secure key, which can eventually be used by the first and the second communications device A and B, or by the respective users, to establish a secure communications session over the conventional link CL. The described operations are then iterated, for example in a periodic manner, to determine new secure keys, for new communications sessions.
In consideration of the above at the level of principle, FIG. 2 shows a cryptographic key distribution system 10 in greater detail, which shall be referred to hereinafter as the cryptographic system 10.
In detail, the cryptographic system 10 comprises a coherent-type optical source 12, such as a laser source for example, which is able to generate electromagnetic pulses, which shall be referred to hereinafter as pump pulses. Purely by way of example, the optical source 12 could be formed by a sapphire-titanium laser operating in the mode-locked state, with a repeat rate of 76 MHz, pulse amplitude of 160 fs and a central wavelength of 830 nm, and configured such that the pump pulses are defined by the double harmonic output and therefore define an electromagnetic field having a centred spectral distribution around a wavelength of 415 nm.
The cryptographic system 10 also comprises a crystal 14, which is arranged so as to receive the pump pulses and is optically nonlinear, and therefore formed by a material having a non-centre-symmetrical crystal lattice. For example, the crystal 14 could be formed by a crystal of barium borate (BBO). Although not shown, the pump pulses can be directed onto the crystal 14 in a manner that is in itself known, for example, by opportune mirrors and/or lenses and/or waveguides.
The cryptographic system 10 further comprises a first and a second reflecting element 16 and 18, an optical trombone 19 and an optical delay line 20, a first half-wave plate 22 and a first optical beam splitter 24, as well as a beam stopper 26.
In greater detail, the beam stopper 26 is arranged facing, and aligned with, the crystal 14, so as to absorb the photons of the pump pulses that pass through the crystal 14 without having given rise to phenomena (described hereinafter) of spontaneous parametric down conversion (SPDC).
The optical delay line 20 is formed, for example, by a further optical trombone. In use, when a photon passes through it, the optical delay line 20 delays this photon by an electronically controllable time τ.
In practice, the crystal 14 forms, together with the first reflecting element 16 and the optical delay line 20, a first optical path 30, which connects the crystal 14 to the first optical beam splitter 24 and is such that the first reflecting element 16 and the optical delay line 20 are interposed between the crystal 14 and the first optical beam splitter 24.
The crystal 14 also forms, together with the second reflecting element 18 and the optical trombone 19, a second optical path 32, which connects the crystal 14 to the first optical beam splitter 24 and is such that second reflecting element 18 and the optical trombone 19 are interposed between the crystal 14 and the first optical beam splitter 24.
Operationally, given a photon of a pump pulse that impinges on the crystal 14, which shall be referred to hereinafter as the pump photon, this can give rise to the phenomenon of spontaneous parametric down conversion, which is a coherent three-photon process. In particular, spontaneous parametric down conversion contemplates the annihilation of the pump photon and the consequent generation of a first and a second converted photon, which are also known as down-converted photons and, as described hereinafter, can be entangled in space-time or, equivalently, in wave number and frequency. Even more particularly, in the case of the so-called type-II spontaneous parametric down conversion, the first and second converted photons are polarized orthogonally to each other, so as to satisfy the so-called phase-matching conditions, i.e. so as to guarantee the conservation of energy and momentum.
In detail, the crystal 14 has a parallelepipedal shape and an optical axis (not shown), which is inclined by an angle Cθ with respect to the pump direction DP, i.e. with respect to the direction in which the pump pulses impinge on the crystal 14. Furthermore, one of the first and second converted photons, which shall also be referred to as the ordinary photon, is polarized in a plane defined by the pump direction DP and by the direction of the so-called slow optical axis of the crystal 14. The other converted photon, which shall also be referred to as the extraordinary photon, is polarized in a perpendicular direction with respect to the pump direction DP and the direction in which the ordinary photon is polarized. It is then possible to define, for example, the above-mentioned direction H as the polarization direction of the ordinary photon, and the above-mentioned direction V as the polarization direction of the extraordinary photon.
In greater detail, as shown in FIGS. 3 and 4, the first and second converted photons are emitted, due to the conservation of momentum, along the edges of two corresponding emission cones C1 and C2. Therefore, as shown by way of example in FIG. 4, the transverse components, indicated as kt1 and kt2, of the propagation vectors of the first and the second converted photon, namely the components of these propagation vectors that lie on a plane perpendicular to the pump direction DP, lie on a same line, have a same origin, have opposite directions and the respective vertices lie along the first and the second emission cone C1 and C2, respectively. Always purely by way of example, FIG. 4 refers to the case where the first and second converted photons emerge from the crystal 14 to define, with respect to the pump direction DP, angles equal to +3° and −3°, respectively.
In consideration of the above, hereinafter reference is made to the so-called degenerate case, i.e. the case in which the first and second converted photons have the same frequency, equal to half the frequency of the pump photon. Furthermore, defining the first and the second lines of intersection between the first and second emission cones C1 and C2 as I1 and I2, it is assumed that the first and the second optical paths 30 and 32 are respectively arranged along the first and the second intersection lines I1 and I2. In this way, both the first and second converted photons can be detected along each of the first and second optical paths 30 and 32.
In other words, it can be assumed that the crystal 14 has a first and a second output, each defined by a corresponding line between the first and the second intersection lines and I2. The first and the second optical path 30 and 32 respectively originate from the first and the second outputs of the crystal 14; in general, it is indifferent which one of the first and second optical paths 30 and 32 takes its origin from the first output of the crystal 14 and which one takes it from the second output. It should also be noted that the angles formed by the first and second optical paths 30 and 32 in FIG. 2 are purely qualitative.
In consideration of the above, a pair of possible states can be defined for the output from the crystal 14. In particular, it is possible to define the |e1|o2 and |o1|e2 states, where subscripts “1” and “2” respectively refer to the first and the second optical path 30 and 32, and subscripts “e” and “o” respectively refer to the extraordinary photon and the ordinary photon. In even greater detail, the state emitted from the crystal 14 can be expressed as:
                                                        ❘              ψ                        〉                    =                                                    C                                  2                                            ⁢                                                ∫                                      -                    L                                    0                                ⁢                                                                  ⁢                                                      ⅆ                    z                                    ⁢                                                            ∫                      0                                              +                        ∞                                                              ⁢                                                                                  ⁢                                                                  ⅆ                                                  v                          p                                                                    ⁢                                                                        E                          p                                                      (                            +                            )                                                                          ⁡                                                  (                                                      v                            p                                                    )                                                                    ⁢                                              ⅇ                                                  ⅈ                          ⁢                                                                                                          ⁢                                                      v                            p                                                    ⁢                          Λ                          ⁢                                                                                                          ⁢                          z                                                                    ⁢                                                                        ∫                                                      -                            ∞                                                    ∞                                                ⁢                                                                                                  ⁢                                                                              ⅆ                            v                                                    ⁢                                                                                                          ⁢                                                      ⅇ                                                                                          -                                ⅈ                                                            ⁢                                                                                                                          ⁢                              Dvz                                                                                ×                          ×                                                      [                                                                                                                                                                                                      a                                      ^                                                                                                              1                                      ⁢                                                                                                                                                          ⁢                                      e                                                                        †                                                                    ⁡                                                                      (                                                                          v                                      +                                                                                                                                                                    v                                            p                                                                                    +                                                                                      Ω                                            p                                                                                                                          2                                                                                                              )                                                                                                  ⁢                                                                                                                                            a                                      ^                                                                                                              2                                      ⁢                                                                                                                                                          ⁢                                      o                                                                        †                                                                    ⁡                                                                      (                                                                                                                  -                                        v                                                                            +                                                                                                                                                                    v                                            p                                                                                    +                                                                                      Ω                                            p                                                                                                                          2                                                                                                              )                                                                                                                              -                                                                                                                                                                          a                                      ^                                                                                                              2                                      ⁢                                                                                                                                                          ⁢                                      e                                                                        †                                                                    ⁡                                                                      (                                                                          v                                      +                                                                                                                                                                    v                                            p                                                                                    +                                                                                      Ω                                            p                                                                                                                          2                                                                                                              )                                                                                                  ⁢                                                                                                                                            a                                      ^                                                                                                              1                                      ⁢                                                                                                                                                          ⁢                                      o                                                                        †                                                                    ⁡                                                                      (                                                                                                                  -                                        v                                                                            +                                                                                                                                                                    v                                            p                                                                                    +                                                                                      Ω                                            p                                                                                                                          2                                                                                                              )                                                                                                                                                        ]                                                                                                                                                                    ❘            0                          〉                            (        1        )            where E+(νp) represents the spectral distribution of the electromagnetic field defined by the pump pulses, this spectral distribution being centred around a central frequency Ωp. Furthermore, C is a normalization constant and L is the length of the crystal 14, measured along the pump direction DP. In addition, â1e† and â2e† are the creation operators related to the extraordinary photon and, respectively, to the first and the second optical paths 30 and 32; â1o† and â2o† are the creation operators related to the ordinary photon and, respectively, to the first and the second optical paths 30 and 32. Furthermore, the following hold:
                              Λ          =                                    1                              u                p                                      -                                          1                2                            ⁢                              (                                                      1                                          u                      e                                                        +                                      1                                          u                      o                                                                      )                                                    ,                                  ⁢        and                            (        2        )                                          D          =                      (                                          1                                  u                  e                                            -                              1                                  u                  o                                                      )                          ,                            (        3        )            where up, ue and uo are respectively the reciprocals of the group velocities in the crystal 14 of the pump photon, the extraordinary photon and the ordinary photon. Lastly, |0 is the vacuum state.
In practice, the extraordinary photon and the ordinary photon propagate inside the crystal 14 with different group velocities due to birefringence. Therefore, in principle, it is possible to distinguish the emissions of the first and the second converted photon, which is the equivalent of being able to discriminate between the |e1|o2 state and the |o1|e2 state. Therefore, at output from the crystal 14, the |e1|o2 and |o1|e2 states are not polarization entangled. However, by acting on an optical delay line 20, it is possible to control the state, so as to achieve indistinguishability.
Again with reference to the first optical beam splitter 24, this if of the polarizing type. In other words, given a generic photon that impinges on the first optical beam splitter 24, the first optical beam splitter 24 transmits or reflects this generic photon according to the polarization of the generic photon; for example, the first beam splitter 24 could transmit the generic photon, if it is polarized in direction H, or reflect it, if it is polarized in direction V.
In greater detail, the first optical beam splitter 24 has a first and a second input and a first and a second output. As already mentioned, the first and the second optical paths 30 and 32 are optically connected to the first optical beam splitter 24, forming precisely the first and the second input, as, in general, the term “input” implies a corresponding propagation direction of an electromagnetic signal or photon that impinges on the first optical beam splitter 24. The definition of the first and the second input of the first optical beam splitter 24 also entails the definition of the first and the second output of the first optical beam splitter 24, which imply corresponding propagation directions of the electromagnetic signal or photons that move away from the first optical beam splitter 24.
For completeness, hereinafter reference is made to the first output of the first optical beam splitter 24 to indicate the propagation direction taken by photons that impinge on the first optical beam splitter 24 after having followed the first optical path 30 and that pass through the first optical beam splitter 24 without being reflected, this propagation direction being coincident with the propagation direction of photons that impinge on the first optical beam splitter 24 after having followed the second optical path 32 and that have been reflected by it. Similarly, hereinafter reference is made to the second output of the first optical beam splitter 24 to indicate the propagation direction taken by photons that impinge on the first optical beam splitter 24 after having followed the second optical path 32 and that pass through the first optical beam splitter 24 without being reflected, this propagation direction being coincident with the propagation direction of photons that impinge on the first optical beam splitter 24 after having followed the first optical path 30 and that have been reflected by it.
The cryptographic system 10 further comprises a second and a third half-wave plate 44 and 46, a first and a second coupler 50 and 52, and a first and a second span of optical fibre 54 and 56.
In detail, the first and second couplers 50 and 52 are respectively optically connected to the first and second outputs of the first optical beam splitter 24. In addition, the first and second spans of optical fibre 54 and 56 are respectively connected to the first and second couplers 50 and 52. Thus, the photons that leave the first output of the first optical beam splitter 24 propagate in free space to a first coupler 50, which connects them to the first span of optical fibre 54. Similarly, the photons that leave the second output of the first optical beam splitter 24 propagate in free space to a second coupler 52, which connects them to the second span of optical fibre 56.
The second and the third half-wave plate 44 and 46 are respectively optically connected to the first and the second span of optical fibre 54 and 56, and therefore are respectively optically connected to the first and the second output of the first optical beam splitter 24.
Although not shown in FIG. 2, a first polarization controller may be present between the first coupler 50 and the first span of optical fibre 54, which performs the function of rendering the main optical axes of the first span of optical fibre 54 parallel to corresponding main optical axes of the first optical beam splitter 24. Similarly, a second polarization controller (not shown) may be present between the second coupler 52 and the second span of optical fibre 56, which performs the function of rendering the main optical axes of the second span of optical fibre 56 parallel to corresponding main optical axes of the first optical beam splitter 24.
The cryptographic system 10 further comprises a first and a second receiving unit RA and RB, respectively optically connected to the first and the second half-wave plate 44 and 46.
The first receiving unit RA comprises a second optical beam splitter 64, of the polarizing type and arranged so that the second half-wave plate 44 is interposed between the first span of optical fibre 54 and the second optical beam splitter 64. The second optical beam splitter 64 has a first and a second output; in addition, the second optical beam splitter 64 has a pair of main optical axes, each of which is parallel to a corresponding optical axis among the two main optical axes of the first span of optical fibre 54.
The first receiving unit RA also comprises a first and a second photodetector 70 and 72, as well as a first processing unit 74. The first and the second photodetector 70 and 72 are respectively connected to the first and the second output of the second optical beam splitter 64, so that they are able to receive photons and generate corresponding electrical signals indicative of photon reception. The first and second photodetectors 70 and 72 are also connected, in output, to the first processing unit 74, which therefore receives the electrical signals generated by them. The first and second photodetectors 70 and 72 may be Geiger-mode avalanche photodiodes, also known as single-photon avalanche photodiodes (SPAD).
In practice, given a generic photon that impinges on the second optical beam splitter 64, the second optical beam splitter 64 transmits or reflects this generic photon according to the polarization of the generic photon. Thus, detection of this incident photon occurs, if it polarized along direction H, on one of the first and second photodetectors 70 and 72, while if it polarized along direction V, it is detected by the other photodetector. Purely by way of example, hereinafter it is assumed that, if this incident photon is polarized in direction H, it is received by the first photodetector 70, and that, if this incident photon is polarized in direction V, it is received by the second photodetector 72.
The second receiving unit RB comprises a third optical beam splitter 78, of the polarizing type and arranged so that the third half-wave plate 46 is interposed between the second span of optical fibre 56 and the third optical beam splitter 78. The third optical beam splitter 78 has a first and a second output; in addition, the third optical beam splitter 78 has a pair of main optical axes, each of which is parallel to a corresponding optical axis among the two main optical axes of the second span of optical fibre 56.
The second receiving unit RB also comprises a third and a fourth photodetector 80 and 82, as well as a second processing unit 84. The third and the fourth photodetector 80 and 82 are respectively connected to the first and the second output of the third optical beam splitter 78, so that they are able to receive photons and generate corresponding electrical signals indicative of photon reception. The third and fourth photodetectors 80 and 82 are also connected, in output, to the second processing unit 84, which therefore receives the electrical signals generated by them. The third and fourth photodetectors 80 and 82 could also be, for example, Geiger-mode avalanche photodiodes.
In practice, given a generic photon that impinges on the third optical beam splitter 78, the third optical beam splitter 78 transmits or reflects this generic photon according to the polarization of the generic photon. Thus, detection of this incident photon occurs, if it polarized along direction H, on one of the third and fourth photodetectors 80 and 82, while if it polarized along direction V, it is detected by the other photodetector. Purely by way of example, hereinafter it is assumed that, if this incident photon is polarized in direction H, it is received by the third photodetector 80, and that, if this incident photon is polarized in direction V, it is received by the fourth photodetector 82.
In general, besides the spontaneous parametric down conversion process and the first half-wave plate 22, the polarization directions with which the first and the second converted photon impinge on the second and the third optical beam splitter 64 and 78 also depend on the second and the third half-wave plate 44 and 46.
In particular, the first half-wave plate 22 is oriented so as to rotate the polarization direction of any photon that passes through it by 90°.
In operation, output from the crystal 14 has the |e1|o2 and |o1|e2 states. Furthermore, it is possible to associate a corresponding two-photon wave function to each of the |e1|o2 and |o1|e2 states.
In detail, the first and the second converted photon impinge on the first optical beam splitter 24 with a same polarization direction, as the photon between them that propagates along the second optical path 32 undergoes a 90° rotation of its polarization direction, under the action of the first half-wave plate 22. Therefore, the first and the second converted photon are both reflected or transmitted by the first optical beam splitter 24.
In other words, the first half-wave plate 22 performs a temporal symmetrization of the two-photon wave function of the |e1|o2 and |o1|e2 states output from the crystal 14, transforming them in the |e1|e2 and |o1|o2 states, while the optical delay line enables totally or partially overlapping the two-photon wave functions.
The first optical beam splitter 24 therefore has a symmetrical quantum output state, which can be expressed, without normalization factors, as |e1|e2+|o1|o2, considering the first and the second output of the first optical beam splitter 24 as belonging to the first and the second optical paths 30 and 32, respectively.
The polarizations of the first and the second converted photon are therefore modified by the second and the third half-wave plate 44 and 46.
In greater detail, the second half-wave plate 44 forms, together with the first receiving unit RA, the first communications device (indicated herein as A1). Furthermore, the third half-wave plate 46 forms, together with the second receiving unit RB, the second communications device (indicated herein as B1).
As previously mentioned, the first and the second communications device A1 and B1 rotate the second and the third half-wave plate 44 and 46 in a pseudorandom manner, which thus form a first and a second basis. Each of the first and the second half-wave plate 44 and 46 can therefore alternatively assume a first or a second position.
In particular, the second half-wave plate 44 has a first and a second main optical axis, orthogonal to each other and also known as the fast axis and slow axis. Furthermore, the respective first and second positions are defined by the values taken by a rotation angle φ.
In detail, in the first position, the second half-wave plate 44 is arranged, with respect to the second optical beam splitter 64, such that, given a generic photon that impinges on the second half-wave plate 44 with polarization parallel to the direction H, after having passed through the second half-wave plate 44, it passes through the second optical beam splitter 64. This first position corresponds, by convention, to rotation angle φ=0°.
The second position of the second half-wave plate 44 is obtained by rotating the second half-wave plate 44, from the first position and around one of the two main axes, for example around the slow axis. The second half-wave plate 44 is rotated precisely by rotation angle φ. For example, hereinafter it is assumed, without loss of generality, that the second position of the second half-wave plate 44 corresponds to φ=22.5°. Therefore, with reference to the generic photon, when the second half-wave plate 44 is in the second position, it is reflected or passes through the second optical beam splitter 64, with equal probability.
With regard to the third half-wave plate 46, this also has a first and a second main optical axis; in addition, the respective first and second positions are defined by the values taken by a rotation angle θ.
In detail, in the first position, the third half-wave plate 46 is arranged, with respect to the third optical beam splitter 78, such that, given a generic photon that impinges on the third half-wave plate 46 with polarization parallel to the direction H, after having passed through the third half-wave plate 46, it passes through the third optical beam splitter 78. This first position corresponds, by convention, to rotation angle θ=0°.
The second position of the third half-wave plate 46 is obtained by rotating the third half-wave plate 46, from the first position and around one of the two main axes, for example around the slow axis. The third half-wave plate 46 is rotated precisely by rotation angle θ. For example, hereinafter it is assumed, without loss of generality, that the second position of the third half-wave plate 44 corresponds to θ=22.5°. Therefore, with reference to the generic photon, when the third half-wave plate 46 is in the second position, it is reflected or passes through the optical beam splitter 78, with equal probability.
In operation, given any photon that impinges on the second or the third half-wave plate 44 or 46, its polarization direction is rotated by an angle equal to 2φ and 2θ, respectively.
In practice, for each converted pair of photons emitted from the crystal 14, the first communications device A1 sets rotation angle φ alternatively equal to 0° or 22.5°, in a pseudorandom manner independent of the second communications device B1. Similarly, for each converted pair of photons emitted from the crystal 14, the second communications device B1 sets rotation angle θ alternatively equal to 0° or 22.5°, in a pseudorandom manner independent of the first communications device A1. Therefore, with time, the values taken by rotation angle φ define a first pseudorandom sequence, while the values taken by rotation angle 0 define a second pseudorandom sequence.
Given an i'th converted pair of photons, and ignoring possible losses or absorptions, one of the photons of the i'th pair is received by the first receiving unit RA, after having passed through the second half-wave plate 44, the latter being rotated such that φ=φi; the other photon of the i'th pair is received by the second receiving unit RB, after having passed through the third half-wave plate 46, the latter being rotated such that θ=θi. If φ1=θ1, that is to say if the first and the second basis are equal, it is found that:                the photons of the i'th pair are respectively received by the first and the third photodetector 70 and 80; or        the photons of the i'th pair are respectively received by the second and the fourth photodetector 72 and 82.        
Given the i'th converted pair of photons, in the case where the first and the second basis are equal, it is then found that, if the first photodetector 70 detects a photon, then the third photodetector 80 also detects a photon. Similar considerations apply to the second and the fourth photodetector 72 and 82.
Purely by way of example, the first processing unit 74 can associate a “0” bit with the detection of a photon by the first photodetector 70 and a “1” bit with the detection of a photon by the second photodetector 72. Similarly, the second processing unit 84 can associate a “0” bit with the detection of a photon by the third photodetector 80 and a “1” bit with the detection of a photon by the fourth photodetector 82.
Repeating the above-indicated operations on further pairs of converted photons, and assuming the absence of photon loss, as well as assuming that the first and the second receiving unit RA and RB are synchronized and each able to associate its own detections with the corresponding detections of the other, the first and the second processing unit 74 and 84 respectively define a first and a second bit string. By way of example, a method of synchronizing the first and the second receiving unit RA and RB is described in TO2003A000069 and in EP1730879.
Then, the first and the second processing unit 74 and 84 reciprocally communicate, for example over the conventional channel to which they are connected (not shown in FIG. 2), the first and the second pseudorandom sequence. Furthermore, the first and the second processing unit 74 and 84 determine a sequence of common bases, i.e. determine when coincidence occurs between the values of the first and the second pseudorandom sequence. In addition, given any value of the first pseudorandom sequence equal to the corresponding value of the second pseudorandom sequence, the first processing unit stores the corresponding bit it has determined; in this way, the first processing unit 74 determines a first correlated substring. Similarly, given any value of the second pseudorandom sequence equal to the corresponding value of the first pseudorandom sequence, the second processing unit 84 stores the corresponding bit it has determined; in this way, the second processing unit 84 determines a second correlated substring.
Ideally, the first and the second correlated substring are equal and form corresponding raw keys. The bits of the first bit string not included in the first correlated substring form a first uncorrelated substring; similarly, the bits of the second bit string not included in the second correlated substring form a second uncorrelated substring. The first and the second uncorrelated strings are discarded by the first and the second processing unit 74 and 84. Purely by way of example, FIG. 5 shows examples regarding the first and the second bit string, as well as the corresponding pseudorandom sequences and the corresponding first and second correlated substrings and first and second uncorrelated substrings.
Then, the first and the second processing unit 74 and 84 perform the above-mentioned key reconciliation and privacy amplification steps, on the basis of the first and the second correlated substring.
Having said that, as previously touched upon, even in the absence of eavesdropping, the first and the second correlated substring do not coincide, due to the noise that characterizes the cryptographic system 10. This noise causes the state defined by the converted pair of photons that impinge on the first and the second receiving unit RA and RB not to be a pure entangled state, but a mixture of states, which can be modelled as a pure entangled state affected by incoherency terms, i.e. by noise.
The physical phenomena that contribute to noise include, among other things, polarization-mode dispersion (PMD), which arises, for example, in the case of propagation in optical fibre, due to the birefringence of the optical fibre itself. In particular, given an optical pulse that is input into a span of optical fibre with a predetermined polarization, PMD causes a change in the polarization of the optical pulse output from the span of optical fibre, as the frequency changes. Similarly, given an optical pulse that is input into a span of optical fibre with a variable polarization, PMD causes a change in the average time delay associated with the distance travelled by the optical pulse in this span of optical fibre, as the polarization of the optical pulse changes.
In greater detail, still with reference to PMD, it is known that, given an optical fibre, a pair of main optical axes exists. These main optical axes correspond alternatively to (average) maximum or minimum time delays, and correspond to the main birefringence axes of the optical fibre. Furthermore, if a photon is sent into the optical fibre with a polarization direction parallel to one of these main optical axes, it maintains its polarization during propagation. In consideration of the above, if a polarization-entangled state is sent into this optical fibre, the entangled state will be affected by noise after propagation through the optical fibre, and in particular by so-called coloured noise, caused by the different group velocities experienced by the photons, as described for example by F. A. Bovino, G. Castagnoli, A. Cabello and A. Lamas-Linares in “Experimental noise resistant Bell inequality violations for polarization-entangled photons”, Physical Review A 73: 062110 (2006).
The causes of noise also include so-called polarization dependent losses (PDL), which arise, for example, inside devices such as optical amplifiers, optical couplers, isolators, circulators, etc.
In general, similarly to what happens in the case of eavesdropping, noise causes degradation of the correlation between the first and the second correlated substring. This natural correlation degradation might be interpreted by the first and/or the second communications device A1 and B1 as eavesdropping perpetrated by a third party. This incorrect interpretation might therefore cause the adoption of protection mechanisms that are, ipso facto, not necessary, such as interrupting communications for example.
The document “Entangled State Quantum Cryptography: Eavesdropping on Ekert Protocol”, by D. S. Naik et al., PHYSICAL REVIEW LETTERS, vol. 84, no. 20, pp. 4733-4736, 15 May 2000, describes an implementation of the Ekert protocol, in which the possible presence of eavesdropping is detected by checking the Bell inequalities. However, the applicant has noted that this implementation does not allow distinguishing different noise contributions that afflict a two-photon entangled state.